Exploit via RTF

By now, most everyone should have the CVE-2015-2424 vulnerability patched, but this caught my attention because the Tsar team uses a RTF file to deliver the payload.

In my experience, people tend to trust a RTF file because it is looked at as a simple text file with a little extra fonts and formatting.
Take a look at the write up from iSIGHT PARTNERS

Microsoft Office Zero-Day CVE-2015-2424 Leveraged By Tsar Team